��o��E"�(W@F�P�(+��Fao�@ �31�>7�g�S+xA:�> �#����>5��9��|^�&Hāq*(�z�X�r9�?qB n��9\`f՛���&XK�sh@��=���7�'l�c��.J(�B�yg�;���ԋ�������G��/�[S8&@A���g�tF���Wf���6&�ng9#R�ȁ�3��9<Z3d^����]��V�2�S�le��=�D{����f��y��wý��lPB��w��t�fs�L`����?�XOG;�Q��R~o� 8E<�w����|H^��/ыBο���n�oڶ@֬+CM����w��OQ�����n/X�_��ڶg��L���Ů.��)?b���Щ�Z�������� wd���D��B�����Ø��Q-STv�r��uߡ,`�Ъ|1���Q�rpKz1�䃵 �YHO��ʄ�G��S'ʳ��L�:�H�t� %��H���~؟<��c���F��06�W�ញ���{4gRuN}�i�ù�����F4c�ul]�|�a�G� x�Kn�d�����Jd�>;W�?e���� �,<.����ivF�D�ܳO*,�<僜�u��Ov��X���H�b�8%(N�ԛ�Դ3��鼚 �P�2��?�3����脎t1~���?7�+�NR�RZ@��0TH L�d_ͤ�s�l� t�?<�c���X�7�����a.h��w2�U��A*����s�H*�~&�r�6P硤@'�����ef��9��U�t�u=W�JU#(�*Y������`9�:���C<,�S�C?�mҬ+^�z����"\��/�f�y�-��%��i����i��[��о'��jN���� ԐI�}�Y3'Ou��l����vq������I�c�Y�[�վT�{����3�hZ�f����sH��n��v�fF\a�y]]t� ��1�>H�^L�'Nf/_W����b�o��h!��*���Aôf��T�.�������dw)���h3P�AVe���1Bx�%U�eJ�� ����l�G ����.�!'�(�_7��8I�Y҆�SHO]����q +$��5;�`�p��.�qo��:�y]�k��)Y��]q{$���0�k���2𪐂h����Uu��V���E�jshlB)�c'�Wa��ݻ|t3��mb�IEŃ�PM�_�J�X�.#u�?>`����R~��YZ3��%]�s�MUV4���N����5�1k��;�h� tn�%nĊ�*ջ4l1Z���J�zzXUL�r�[�vd,VSϘpE�|�]\kWS����M�Cߥ�pk�����OW( q���O5�+�|�7j(J�!��aM����Qn�Ho���:�؝������p��}�����zmԐB��tS��.&!���\�<�$뤽����3��zfW#v�BY�0T1��Ź��Z"È�ebΓ�A{�Zw���E~l��z�+��i��~QU�{�Շ�K{k�d�`:�ZEP�b��o�&d�<�o���l�l)B�B&������L�d��řUu�$(�>�K2��0W��#}���Y�t�.�-������.��<4K�D�l�B%�ޤ�=��kB�_��C�r���X�������xmʜ�:lF�pV39`��;#�}��W��~9��PPK5�N�xiC֛יW��@�Q��a,���!]�Q� _&\�6�Q��� ��oݏʄIR�ܨ,�WHC���l�g_����$i/� N��dN����oD/��&dB�*0���IU,�]AKY���S0!wzd �����2���RN�2N W��bcs��`\VI�I���L���$e;%@l��������Ġm�r4dzkE�OH0)sR�87�)}��ɬa�A�1�?ϓ���a��7��}�w�6�M�2^�Os�����Ț���gf��qI\�>�)9-��&Z� �(f����P"e�Np�"���}T�̹N���2�n��3��|�n��������ܔKW�f�|�C��Ng�@��Ӱm�iV�{��j[�c��ݿ��T�R�9=l�0�ǡHb�`���p�Ċ���\��ʗ)Pۯ�.��We�N|�fm��}c8�R���S�6���T���!S��C��H�=9H�`U�J$hh�w���|6+�+��Ok~_A]�y�����:<����:���91Jsl|����*�S��6�,_e�j3��o!?�����!�u�&���>h���Q>�Q#�c@m�D(�c��_��N�0��X���vc�E��w��̓+.z�>n�����9��1Ͱ�C6��ق� 3N;���QD.`�{1����XLL�À�-�08̀�N*?Y2�ţ�+ai�4s ��^��Y�,��϶��U��0/�0��5�<��f_�F1�e����o�o��Z���,�zj#�0�|���;5)~6:�y�����X��,�W�����ɱ���.�!��#��˳&A��>]1L}��l�o�cǿ,����7#�K<S e�zt��1a;D�ZGV�/�=�T�E�(��X��tT��&��_lM�F9���H>��|l��� ��}��J�ŞF3�����=��.�P�[�/_��}뎦�Yv����@�1�[��=#� ��dD��!������<+k��î^:�E�b�t W{Vb�o���a��r����ET�J$����Mcq���%����H�龇,���!�G)v�W#��B�kƙ�9��卫D�� ����i<k��9L��f��Uw���R���^�=MC#z&�+��˰bd=�-���ȑwH�]����MK�b��zL���@�U�3�N��,��YQy1%�9�:��zs�����ߑ��{���W��4�&������U ~�����ȶ5,���R`����m�k�����6������E��x������@�m��q��凪:/��܁��^Ͻu�H���������+�F\���e�G���'d_t����/)T-g4Ɠ P w���6���so�U��JҀ)@�/M՜���(���kT�])<���$>�gɽ,c����>G'_ m�����ݨӛ��@��B�MnbF9������b�$��]��V. c���ilx��1�cK.Z6��f�Oe
Static task
static1
Behavioral task
behavioral1
Sample
7568a61affbe8f38cb951a8f4c4191809470b24d046a043602db5f4717f721f4.exe
Resource
win7-20240508-en
General
-
Target
7568a61affbe8f38cb951a8f4c4191809470b24d046a043602db5f4717f721f4.exe
-
Size
8.8MB
-
MD5
97649c9e1e76f3e4bd85b26caa806cf1
-
SHA1
83d8ccc5a595030fa2fcaedb92e4402237f1a33c
-
SHA256
7568a61affbe8f38cb951a8f4c4191809470b24d046a043602db5f4717f721f4
-
SHA512
c7ca4a5c6193be6a5533e49cd1744d8809291a9f08c63bf6f080e97bc85f9d6b41dfe15c337ea802f2d0bcba4bd589941671c1f17e61d186851154e0ad97b829
-
SSDEEP
196608:G75HPwsO2FGMeBJwkQse3gS8xovaCoNTyxH3DKGj:e5HPzO2FCBJwkQsSgNyaHPGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7568a61affbe8f38cb951a8f4c4191809470b24d046a043602db5f4717f721f4.exe
Files
-
7568a61affbe8f38cb951a8f4c4191809470b24d046a043602db5f4717f721f4.exe.exe windows:6 windows x64 arch:x64
da5619412e3a33d6d832dab87f12c16d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSASetLastError
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertFreeCertificateContext
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetLastInputInfo
CharUpperBuffW
shell32
SHGetSpecialFolderPathA
ole32
CoInitializeEx
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.)ZM Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.w_e Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+yj Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ